{"record":{"id":"daaf098a9209b289","repo":"apache/pulsar","slug":"invalid-privatekey-format-daaf09","errorCode":null,"errorMessage":"Invalid privateKey format","messagePattern":"Invalid privateKey format","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client-auth-athenz/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationAthenz.java","lineNumber":329,"sourceCode":"        } catch (InstantiationException | IllegalAccessException | IOException e) {\n            throw new IllegalArgumentException(\"Cannnot get absolute path from specified URL\", e);\n        }\n    }\n\n    private static PrivateKey loadPrivateKey(String privateKeyURL) {\n        PrivateKey privateKey = null;\n        try {\n            URLConnection urlConnection = new URL(privateKeyURL).openConnection();\n            String protocol = urlConnection.getURL().getProtocol();\n            if (\"data\".equals(protocol) && !APPLICATION_X_PEM_FILE.equals(urlConnection.getContentType())) {\n                throw new IllegalArgumentException(\n                        \"Unsupported media type or encoding format: \" + urlConnection.getContentType());\n            }\n            String keyData = CharStreams.toString(new InputStreamReader((InputStream) urlConnection.getContent(),\n                    Charset.defaultCharset()));\n            privateKey = Crypto.loadPrivateKey(keyData);\n        } catch (URISyntaxException e) {\n            throw new IllegalArgumentException(\"Invalid privateKey format\", e);\n        } catch (CryptoException | InstantiationException | IllegalAccessException | IOException e) {\n            privateKey = null;\n        }\n        return privateKey;\n    }\n}\n","sourceCodeStart":311,"sourceCodeEnd":336,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client-auth-athenz/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationAthenz.java#L311-L336","documentation":"loadPrivateKey reads the key data from the URL and parses it with Crypto.loadPrivateKey. A URISyntaxException is rethrown as IllegalArgumentException('Invalid privateKey format'); a CryptoException or IOException results in null being returned (which surfaces as error 'Failed to load private key...' from setAuthParams). So this specific message means the privateKey URL string itself is malformed.","triggerScenarios":"configure() called with a 'privateKey' value that is neither a valid URL nor valid data URI — e.g. raw PEM text without the 'data:' prefix, or a truncated/typo'd URI scheme.","commonSituations":"Pasting the multi-line PEM body directly as privateKey (newlines break the URI parser); forgetting the data:application/x-pem-file prefix; typos like 'data::...' or 'file//...'.","solutions":["Prefix PEM content correctly: 'data:application/x-pem-file,<pem>' or base64-encode it with the same media type","Alternatively use 'privateKeyPath' with a well-formed file:/// URL","Remove/escape newlines and whitespace from the URI value"],"exampleFix":"// before\n\"privateKey\":\"-----BEGIN PRIVATE KEY-----\\nMIIEv...\\n-----END PRIVATE KEY-----\"\n// after\n\"privateKey\":\"data:application/x-pem-file,-----BEGIN PRIVATE KEY-----\\\\nMIIEv...\\\\n-----END PRIVATE KEY-----\"","handlingStrategy":"validation","validationCode":"String pk = params.get(\"privateKey\");\nif (pk != null && !pk.startsWith(\"data:\") && !pk.contains(\"://\")) {\n    throw new IllegalArgumentException(\"privateKey must be a data: URI or URL, not raw PEM text\");\n}\ntry { new URI(pk); } catch (URISyntaxException e) {\n    throw new IllegalArgumentException(\"privateKey is not a valid URI (strip newlines, add data: prefix)\", e);\n}","typeGuard":"boolean isUriLike(String s) {\n    return s != null && (s.startsWith(\"data:\") || s.startsWith(\"file:\") || s.contains(\"://\"));\n}","tryCatchPattern":"try {\n    authentication.configure(authParamsJson);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().equals(\"Invalid privateKey format\")) {\n        log.error(\"privateKey must be a valid URI — wrap PEM in data:application/x-pem-file,... or use privateKeyPath\");\n    }\n    throw e;\n}","preventionTips":["Never paste raw PEM text into privateKey — always wrap it in a data: URI","Strip/escape newlines when embedding multi-line PEM content","Prefer privateKeyPath with a file:/// URL when the key lives on disk"],"tags":["java","athenz","pem","url","auth-config"],"backgroundTag":"invalid-key-format","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}